Which versions of Ajenti are affected by CVE-2026-40177?

Ajenti admin panel versions prior to 0.112 contain a critical authentication bypass that allows unauthenticated attackers to gain full administrative access when two-factor authentication is enabled,…. A patch is available.

How to fix or mitigate CVE-2026-40177?

Within 24 hours: Identify all Ajenti deployments running versions prior to 0.112 and disable remote access to the admin panel or isolate affected systems behind network segmentation. Within 7 days: Contact Ajenti vendor for patch availability timeline and status; implement network-based authentication controls (VPN/IP allowlisting) for all admin panel access. Within 30 days: Upgrade to Ajenti 0.112 or later when vendor patch becomes available; conduct full audit of admin panel access logs and managed system configurations for evidence of unauthorized access.

Ajenti CVE-2026-40177

Q: What is the CVSS score of CVE-2026-40177?

CVE-2026-40177 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21575 CRITICAL

Improper Authentication (CWE-287)

2026-04-10 GitHub_M

GHSA-3mcx-6wxm-qr8v

Authentication Bypass Ajenti

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 19:37 vuln.today

cvss_changed

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 20:15 euvd

EUVD-2026-21575

Analysis Generated

Apr 10, 2026 - 20:15 vuln.today

CVE Published

Apr 10, 2026 - 19:29 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.

AnalysisAI

Authentication bypass in Ajenti admin panel versions prior to 0.112 allows unauthenticated remote attackers to completely circumvent password authentication when two-factor authentication (2FA) is enabled. Attackers can gain full administrative access to the Ajenti server management interface without valid credentials, compromising confidentiality and integrity of managed systems. No public exploit identified at time of analysis.

Technical ContextAI

Improper authentication implementation (CWE-287) in ajenti.plugin.core module creates logic flaw where 2FA activation inadvertently disables primary password validation. Network-accessible (AV:N) with no complexity (AC:L) or user interaction (UI:N) required. CVSS 4.0 base score 9.3 reflects unauthenticated (PR:N) remote compromise with high confidentiality and integrity impact.

RemediationAI

Vendor-released patch: upgrade immediately to Ajenti version 0.112 or later, which resolves the authentication bypass vulnerability. Organizations unable to upgrade immediately must disable two-factor authentication functionality until patch deployment, though this reduces security posture. Review access logs for unauthorized administrative sessions during vulnerable period. Restrict network access to Ajenti administrative interface using firewall rules or VPN to trusted IP ranges only. Official security advisory: https://github.com/ajenti/ajenti/security/advisories/GHSA-3mcx-6wxm-qr8v